Back to the 2026 archive

COMPETITION.

The 2026 format paired four-person teams with three tracks: Harden, Hack, and Hunt. This archive preserves the scoring method and published prize plan.

17–20 SEP 2026Four competition days
TEAMS OF 4One overall ranking
3 TRACKSNormalized and weighted
01 / THE JOURNEY

THREE DIFFERENT SECURITY PERSPECTIVES

DEFEND.
ATTACK.
INVESTIGATE.

CyberShield is one connected team competition made up of three distinct environments. Teams harden a defensive environment, attack a target network, and investigate evidence from a simulated incident.

The environments are designed around related professional skills.

Archived program
02 / FOUR COMPETITION DAYS

EVERY TRACK
COUNTS.

17 SEP · DAY 1

HARDEN

Reduce verified security exposure in a vulnerable or misconfigured environment while keeping required services operational.

Explore Harden ↗
18–19 SEP · DAYS 2–3

HACK

Discover attack paths, exploit weaknesses, pivot through a target environment, and capture validated objectives.

Explore Hack ↗
20 SEP · DAY 4

HUNT

Analyze evidence, reconstruct activity, identify indicators, and determine what happened during a simulated incident.

Explore Hunt ↗
03 / WEIGHTED SCORING

ONE RANKING.
THREE RESULTS.

Each track may use a different number of available points. To make the results comparable, every track score is first normalized to 100. The confirmed track weights are then applied.

Hack contributes 50% of the final score. Harden and Hunt each contribute 25%.

DAY 125%

HARDEN

Verified improvement after the post-hardening assessment.

DAYS 2–350%

HACK

Validated flags and required evidence submitted through CTFd.

DAY 425%

HUNT

Correct investigative findings submitted through CTFd.

01

EARN TRACK POINTS

Complete validated hardening checks, flags, and investigative objectives.

02

NORMALIZE TO 100

Track points earned ÷ track points available × 100.

03

APPLY THE WEIGHT

Multiply each normalized result by 25%, 50%, or 25%.

04

COMBINE RESULTS

Add the three weighted results to determine the overall ranking.

FINAL SCORE

(Harden × 0.25) + (Hack × 0.50) + (Hunt × 0.25)

WORKED EXAMPLES

HOW THREE DIFFERENT RESULTS BECOME ONE SCORE

Illustrative examples from the published scoring guidance, not actual team results.

EXAMPLE 01 · BALANCED

80.0 FINAL SCORE

  • Harden: 80 × 25% = 20
  • Hack: 80 × 50% = 40
  • Hunt: 80 × 25% = 20

20 + 40 + 20 = 80.0

EXAMPLE 02 · STRONG HACK

80.0 FINAL SCORE

  • Harden: 60 × 25% = 15
  • Hack: 95 × 50% = 47.5
  • Hunt: 70 × 25% = 17.5

15 + 47.5 + 17.5 = 80.0

EXAMPLE 03 · NORMALIZING RAW POINTS

82.5 FINAL SCORE

  • Harden: 42/60 = 70 → 17.5
  • Hack: 1,800/2,000 = 90 → 45
  • Hunt: 72/90 = 80 → 20

17.5 + 45 + 20 = 82.5

04 / HOW POINTS ARE EARNED

MEASURE WHAT
THE TEAM ACHIEVES.

HARDEN

Measured improvement

Organizers assess the template environment before the challenge. After time expires, each team environment is scanned. Points reflect verified reduction in weighted security weaknesses while required services remain available.

HACK

Validated objectives

Teams earn points through CTFd for valid flags and required evidence obtained inside the authorized target environment. Higher-value objectives may require deeper access or several connected steps.

HUNT

Evidence-based findings

Teams earn points through CTFd for correct investigative findings, validated artifacts, and accurate conclusions drawn from the provided incident evidence.

HARDEN SCORE TIMING

HARDEN: POST-CHALLENGE SCORING.

The published method used post-challenge assessment for Harden rather than a live flag-based score.

The assessment process compared each hardened environment with the baseline, checked required services, and calculated a normalized result.

  1. 01
    BASELINE

    Organizers assess the template environment before the event.

  2. 02
    HARDEN

    Teams make security improvements during the challenge.

  3. 03
    POST-ASSESSMENT

    Organizers scan and validate each team environment after time expires.

  4. 04
    25% RESULT

    The verified score is normalized to 100 and added to the final ranking.

05 / FINAL RULES

CLEAR BEFORE
THE CLOCK STARTS.

BEFORE COMPETITION

The published weights were 25% / 50% / 25%. The source page did not include the final service checks, penalties, score-lock process, or tie-break order.

  • Only authorized environments may be tested
  • Teams submit only work and evidence they obtained
  • Competition and scoring infrastructure may not be attacked
  • Final organizer decisions protect fairness and platform stability
06 / TEAM PRIZES

FOUR IDENTICAL BUNDLES · SIXTEEN ITEMS

PRIZES FOR THE
TOP FOUR TEAMS.

The published prize plan allocated one CyberShield Team Prize Bundle to each of the top four teams, with four practical technology items per bundle.

Training and certification opportunities were also listed for the top three teams. Providers and award conditions were not confirmed in the published source. This page does not confirm prize delivery.

Four items in the CyberShield Team Prize Bundle: a 65W GaN charger, adjustable laptop stand, sling bag, and USB-C hub
  1. 01

    65W GAN CHARGER

    Compact USB-C charger with cable.

  2. 02

    6-IN-1 USB-C HUB

    Ethernet, HDMI, power delivery, and USB connectivity.

  3. 03

    ADJUSTABLE LAPTOP STAND

    Rotating aluminum desktop riser.

  4. 04

    SLING BAG

    Compact crossbody bag with secure storage.

1 BUNDLE PER TOP-FOUR TEAM1 charger · 1 hub · 1 stand · 1 sling bag

THE STORY CONTINUES

BACK TO THE
COMMUNITY.

Explore CyberShield